Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
framework_sensors_0.0.0.6_EVCert_Debug/FrameworkSensors.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
framework_sensors_0.0.0.6_EVCert_Debug/install_frameworksensors.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
framework_sensors_0.0.0.6_EVCert_Debug/install_frameworksensors.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target framework_sensors_0.0.0.6_EVCert_Debug/install_frameworksensors.bat
- Size 878B
- Sample261102-nywp3seh58
- SHA256 a91a752c9917b941158a951ef097007940f59b84a51bbec814a517c6c55aed4a
- MD5 ec056f242515712450dbb05f1ed957b0
- SHA1 35a2551524e48dd55f89322b5439b85f4e886bdc
- SHA512 297b1af926e5799081c0e010ee599a3917b8a71c75ec02979e419e1dc6e303acd48fd72aa52234264c1778911a08d261f9391e6e21d5fd021eb523854fcbafc2
- TLSH T119115C090C8686322272D2B0D7272540F66EF1073C2848B4F56361A49DFA2849BFD6D9
- MD5 SHA1 SHA512 TLSH
Score
8/10
Malware Config
Signatures
- Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\243739A0C90E373D5D89308ACADB8692C8419BEC\Blob = 030000000100000014000000243739a0c90e373d5d89308acadb8692c8419bec19000000010000001000000058e740378bd5e79842e73b21e6b5cd8c0400000001000000100000001cb8369abcdbb82c516b2403760d20e90f00000001000000200000006733b04c146a97e6f89c29e440fafb5cc7219fd54ae68cf965c58f1c5ebd89d42000000001000000e4050000308205e0308203c8a00302010202101a38ae2319b9a2dab8dea5814b36dd62300d06092a864886f70d01010b0500307b310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e3111300f060355040a0c0853534c20436f72703137303506035504030c2e53534c2e636f6d20455620436f6465205369676e696e6720496e7465726d65646961746520434120525341205233301e170d3234303431313033303433345a170d3237303430313035323632325a3081dd310b30090603550406130255533113301106035504080c0a43616c69666f726e69613116301406035504070c0d53616e204672616e636973636f311f301d060355040a0c164672616d65776f726b20436f6d707574657220496e633110300e0603550405130737373631323431311f301d06035504030c164672616d65776f726b20436f6d707574657220496e63311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31193017060b2b0601040182373c0201020c0844656c617761726531133011060b2b0601040182373c020103130255533076301006072a8648ce3d020106052b8104002203620004f48332d1802818e69cd48a2000958294735d67729411b16da80ebf3cdccccc42e00a386e9781e13cd641a9e41e31c29e1cfb9ce2dd8f0b4506515c3f217fe8f5d3b7d0dc4a32210b596573b57097caa78249e8b93bc3434469d71d7242794ad4a38201a9308201a5300c0603551d130101ff04023000301f0603551d2304183016801436bd49ff312cebaf6a40fe99c016edbafc48dd5f307d06082b060105050701010471306f304b06082b06010505073002863f687474703a2f2f636572742e73736c2e636f6d2f53534c636f6d2d53756243412d45562d436f64655369676e696e672d5253412d343039362d52332e636572302006082b060105050730018614687474703a2f2f6f637370732e73736c2e636f6d305f0603551d20045830563007060567810c0103300d060b2a84680186f67702050107303c060c2b0601040182a93001030302302c302a06082b06010505070201161e68747470733a2f2f7777772e73736c2e636f6d2f7265706f7369746f727930130603551d25040c300a06082b0601050507030330500603551d1f044930473045a043a041863f687474703a2f2f63726c732e73736c2e636f6d2f53534c636f6d2d53756243412d45562d436f64655369676e696e672d5253412d343039362d52332e63726c301d0603551d0e041604140592833f7ea17e2ebc67534751d248b3d5881b45300e0603551d0f0101ff040403020780300d06092a864886f70d01010b05000382020100e34e965bae83e986a61aa234b9ac8e59184ef2615c86f4730b1e0e1f42054f5538dcc5925cf21571a6dddc21dd035635f802e3182000f8b43e9a6284f6a7626fc00a86a8775bdffac2cdc903e696d74da93b27c0aa162490066fab92a5b3ffcebc1a39e317fa9e0a4316d687dcb142a8a7942d629c6b7a4f65720a0581671e0265152b844f7daec12fe49aa8e8003d6865a883939ba4adc28bcbbf8f52757fe35a0d83f5ba2d4401cd379262ef49e86e3f82dbecf1b7bdca017a12f1e15f94d64d09ab4dc68a3f6cab2e342a0bc9e855a7d1d63aedf69ee55e0e0a8bd7016de4b5b1cac34ae3617c96744885d97129b4cf61debb4aa186d66c4f852f2c93342e2a8986a68501bf9d7fcd4cd963d8771b8b162c4abd709c88d0bbc546104e76fc736a4f3e1db2777d400e176f4abd9638124db5b22df42322fb7c96f89ff4806ce85ef6f6cd68c402f215e34f42ba5649c1ad42e4e41b1983cd86d1d368766e8c57473a15f9a1173d233c2b8aecbb43e3dacb54aca28e6ab9da2fe7256ba09638f96792d23736ef223856770bc1cc216f677967827459a5a6c9b134c6d6d568ac6f2020df4b87c8820b54db995ed52bbf3f31ac429f513c992de777cf89e41e4254e1ee54f3218677b44224784c7254b6bba6b91cbe36b3b19a7d05904b7ecaadfae6d9e708ab0b5164a3db17a4694061450352efb216a541f4afcf059af8fde2 DrvInst.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{4f907087-328c-c645-bc2b-bc7d670f06ba}\SETCA61.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\frameworksensors.inf_amd64_56ddcad6a3d6293b\FrameworkSensors.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4f907087-328c-c645-bc2b-bc7d670f06ba} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4f907087-328c-c645-bc2b-bc7d670f06ba}\SETCA61.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4f907087-328c-c645-bc2b-bc7d670f06ba}\SETCA71.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4f907087-328c-c645-bc2b-bc7d670f06ba}\FrameworkSensors.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\frameworksensors.inf_amd64_56ddcad6a3d6293b\FrameworkSensors.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{4f907087-328c-c645-bc2b-bc7d670f06ba}\SETCA50.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4f907087-328c-c645-bc2b-bc7d670f06ba}\FrameworkSensors.cat DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4f907087-328c-c645-bc2b-bc7d670f06ba}\SETCA50.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4f907087-328c-c645-bc2b-bc7d670f06ba}\FrameworkSensors.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{4f907087-328c-c645-bc2b-bc7d670f06ba}\SETCA71.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\frameworksensors.inf_amd64_56ddcad6a3d6293b\FrameworkSensors.cat DrvInst.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log pnputil.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4404 cmd.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe - Modifies data under HKEY_USERS 42 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeAuditPrivilege 3804 svchost.exe Token: SeSecurityPrivilege 3804 svchost.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4404 wrote to memory of 3416 4404 cmd.exe 86 PID 4404 wrote to memory of 4740 4404 cmd.exe 87 PID 3804 wrote to memory of 5040 3804 svchost.exe 89 PID 5040 wrote to memory of 5044 5040 DrvInst.exe 90 PID 4404 wrote to memory of 116 4404 cmd.exe 96
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\framework_sensors_0.0.0.6_EVCert_Debug\install_frameworksensors.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵PID:3416
-
-
C:\Windows\system32\pnputil.exepnputil -a "C:\Users\Admin\AppData\Local\Temp\framework_sensors_0.0.0.6_EVCert_Debug\\frameworksensors.inf" /install2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4740
-
-
C:\Windows\system32\cmd.execmd /k2⤵PID:116
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ccdb36f9-4908-424e-b388-538074952178}\FrameworkSensors.inf" "9" "4e6745d3f" "0000000000000144" "WinSta0\Default" "000000000000015C" "208" "C:\Users\Admin\AppData\Local\Temp\framework_sensors_0.0.0.6_EVCert_Debug"2⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{b98aba8d-66e2-3042-ad63-1f994f9a0555} Global\{2d5419e1-9cd2-a14b-9087-4280012d09ef} C:\Windows\System32\DriverStore\Temp\{4f907087-328c-c645-bc2b-bc7d670f06ba}\FrameworkSensors.inf C:\Windows\System32\DriverStore\Temp\{4f907087-328c-c645-bc2b-bc7d670f06ba}\FrameworkSensors.cat3⤵PID:5044
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\{ccdb36f9-4908-424e-b388-538074952178}\FrameworkSensors.cat
- Size 8KB
- SHA256 7261ec2704367045012989d5a606052ff00e5551a354001fe83de3c8aa85bc3c
- MD5 e5bf0e8065b175c8cc82bb7586ed1da9
- SHA1 d51fe930adc04c11f0e2ea71850e0f168955074e
- SHA512 38fc7b91a256a86ad9aff9a240c3c03c50871a78f3469318413b54010a06b0cb46aad40d5fd175b25738cfd67a54ebe092dc5a670da67b007dfa9e42caa8651d
- SSDEEP 192:Igc+hfe3IUwlfBC81fjJFQ/hei3i64m/kVf:CwlJC87FChCm/kVf
- TLSH T145022AE35E1E4191ED838F60F4C0A81BEC736ECA954460EA705BA6195CC4BD07E2F43E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{ccdb36f9-4908-424e-b388-538074952178}\FrameworkSensors.dll
- Size 64KB
- SHA256 7c1d0d54f02c156085fba667c8b307f00aca82f17060531286d0559f4dc7f564
- MD5 378cf730d4cb42f3ce4a31d88b4379e3
- SHA1 5712098c793a682bc2f1a5cf84938fcb7ced1eb5
- SHA512 469f03fe957600b771b12616c61d9f460e2cadacdbc7be7b5954832274c704a71d6b2c3c145ee3c46e1a1c9fd94c46e65064441d990611ad4a903398a647b8e7
- SSDEEP 768:Hb9ZaITnu25tva3iyxNWPQakN3KSZ1W0JVEWjaD+JSksVkJs7DEKDa:VTu0/yxN+NjA1ZJVowxGDEKDa
- TLSH T14753B54ED3952096E47CC3B786A30576607FB8058B38ABC7578D22790F827C0897E3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{ccdb36f9-4908-424e-b388-538074952178}\FrameworkSensors.inf
- Size 4KB
- SHA256 d3d2f2e73fc2e45d94a434ed06e5247bbe10a59d31a4c57f9efdf8cfdf689f15
- MD5 50a7d6bcd75c1ce931670c488d02991b
- SHA1 43eedfb497b3fde5485b4a552dc8ae061f58d169
- SHA512 714c552a5aabc6dd5e8cd73af4d1d246b41e67577e90f64ac3f153d3a26c58afe6221c8fd9e1085fa06eb12886889013c8166f27f49a72138e76eaacf8dcddef
- SSDEEP 48:1OcKGNuXuSXi24kMNJvptNJmNtVXNcN9NgNfuNaNzNVNut+XI7N7sN92NIN8wNjw:28Bk45txO7lUvTZ
- TLSH T178912E1253FA0A04F0B65E40AAB594669A337D946D399B4C03DC510A27FFE84D9B2FA3
- MD5 SHA1 SHA512 SSDEEP TLSH